Data flow, access and boundaries.
Lead Desk runs in your Google account and sends email as you, so it has to be careful. Here is where data goes, what access it needs, the safeguards it has, and what we have and haven’t verified.
Data flow
Inquiries stay in your account.
A form submission goes to the script attached to your sheet, is written to that sheet, and replies go out from your Gmail. Banira’s systems are not in that path.
- Your website formA customer sends an inquiry
- Your Google SheetEach inquiry becomes a row you own
- Apps Script, in your accountApplies your rules and schedule
- Your GmailSends the approved reply and follow-ups
- YouAlert, daily summary, and the next action
Stored
In your Google Sheet: name, email, phone, ZIP, message, score, status and follow-up history. A log sheet records events and IDs, not message contents.
Sent
From your Gmail: the approved replies and follow-ups to customers, and alerts and summaries to you. Error emails contain no customer details.
Not kept by Banira
We don’t copy inquiries to our systems. Intake answers and your configuration are kept to deliver the work, and deleted 30 days after handover unless you choose Care.
Access
Permissions, and why each is needed.
Google asks you to approve these when the script is first set up. You can review or remove them in your Google account at any time.
| Permission | Used for |
|---|---|
| This spreadsheet only | Writing inquiries and the log to the sheet the script is attached to. It doesn’t request access to your other files. |
| Read, compose and send email | Sending approved replies and follow-ups, and reading the reply threads it started to detect answers and “stop” requests. Google doesn’t offer a narrower permission that allows both. |
| Send email as you | Owner alerts and the daily summary, and checking how much of the daily email quota is left. |
| Run on a schedule | The hourly follow-up check and the 7:00 summary. |
| Google Forms (only if used) | Receiving submissions from your Google Form. |
| External request (only if bot check is on) | Verifying a bot-check token with the provider. The secret stays in your script settings, not in the web page. |
Safeguards
Designed so a mistake stays small.
- Send limits. One automatic reply per address per 24 hours, plus hourly and daily caps, so the form can’t be used to flood an inbox.
- Fixed messages. Replies come from approved templates. The visitor’s text is never echoed; their first name is used only after links, symbols and formulas are removed.
- Quota reserve. Automatic replies stop before the daily email limit so your alerts still get through.
- Bot filters. A hidden honeypot field, a minimum time to fill the form, link-spam scoring, and an optional bot check verified server-side.
- Duplicate protection. The same person sending the same message twice within a day makes one record and one reply.
- Spreadsheet-safe text. Text starting with
=,+,-or@is stored as plain text, not run as a formula. - No double follow-ups. A lock prevents overlapping runs, and each follow-up is recorded before and after sending. An interrupted send is flagged for a person to review, not retried automatically.
- Honest test mode. Records what would be sent, sends nothing, and doesn’t use up follow-ups.
- Failures are visible. If an email fails, the inquiry is still recorded, marked needs attention, and reported to you.
Boundaries
What Lead Desk can’t protect against.
It depends on Google’s services and quotas. If they’re down, sending waits.
We can’t guarantee every email reaches the inbox. Domain authentication helps.
It’s only as secure as your Google account. Use two-step verification.
Not designed for health, payment or ID data. Ask customers not to send it through the form.
Verification status
The safeguards above are covered by 53 automated tests run against simulated Google services (Lead Desk v1.1). They have not yet been verified in a live client account. Each installation is tested live in the client’s account, with addresses the client controls, before it goes live.
Reporting a problem: use the contact form and mark it “security”. A dedicated security address will be added once Banira’s mailbox exists.